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ATTACHMENT C 



CLAIMS: 

Claims 1-38 (canceled) 

39. (new) An apparattis for monitoring and auditing activity in a network, 
5 the network utilizes an incremental protocol, the apparatus comprising: 

an analyzer operative to analyze intercepted packets conveyed by entities 
in the network and to generate analyzed data based on information associated 
with at least some of said packets, the analyzed data being indicative of sessions; 

a mirror manager responsive to said analyzed data for generating data 
10 representative of mirror sessions, each mirror session corresponding to one of 
said sessions; and 

an audit event analyzer for processing at least part of said data 
representative of a mirror session and generating data representative of audit 
events that include inbound audit events and outbound audit events, said 

15 outbound audit events including information for instructing a terminal how to 
draw screens to be displayed thereon and serving to prompt a user to perform 
operations each in respect of a corresponding outbound audit event, and said 
inbound audit events including information representative of the operations 
performed on the terminal in respect of said outbound audit events, said audit 

20 event analyzer further processing successive one or more outbound audit events 
and one or more inbound audit events for incrementally generating cumulative 
data representative of a respective united audit event that combines preceding 
outbound and inbound audit events, said united audit event including information 
that enables displaying a current status of the screen on a terminal without 

25 requiring that the preceding outbound and inbound events be displayed prior 
thereto. 
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40. (new) The apparatus of Claim 39, further comprising: 

a business event analyzer for processing at least part of said data 

representative of outbound, inbound and united audit events and generating data 

representative of business events. 

5 41. (new) The apparatus of Claim 40, further comprising: 

an alerts manager coupled to the business event analyzer and being 

responsive to said data representative of business events for generating alerts. 

42. (new) The apparatus of Claim 41, wherein the alerts manager is 
configured to generate at least some of the alerts based on predetermined 

10 thresholds. 

43. (new) The apparatus of Claim 39, further comprising: 

a first long term storage device for storing at least part of said analyzed 

data. 

44. (new) The apparatus of Claim 39, further comprising: 

15 a second long term storage device for storing at least part of said data 

representative of mirror sessions. 

45. (new) The apparatus of Claim 39, further comprising: 

a compression agent for compressing at least part of the data 
representative of mirror sessions. 
20 46. (new) The apparatus of Claim 39, further comprising: 

an encryption agent for encrypting at least part of the data representative 
of mirror sessions. 

47. (new) The apparatus of Claim 39, further comprising: 

a signature agent for digitally signing at least part of the data 
25 representative of mirror sessions. 

48. (new) A method for monitoring and auditing activity in a network, the 
network utilizes an incremental protocol, the method comprising: 

analyzing intercepted packets conveyed by entities in the network; 
generating analyzed data based on information associated with at least 
30 some of said packets, the analyzed data being indicative of sessions; 
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responsive to said analyzed data generating in respect of one or more of 

said sessions data representative of one or more mirror sessions, each mirror 

session corresponding to a session; and 

processing at least part of said data representative of a mirror session and 

5 generating data representative of audit events that include inbound audit events 

and outbound audit events, said outbound audit events including information for 

instmcting a terminal how to draw screens to be displayed thereon and serving to 

prompt a user to perform operations each in respect of a corresponding outbound 

audit event, and said inbound audit events including information representative 

10 of the operations performed on the terminal in respect of said outbound audit 
events, wherein processing further includes processing successive one or more 
outbound audit events and one or more inbound audit events for incrementally 
generating cumulative data representative of a respective united audit event that 
combines preceding outbound and inbound audit events, said united audit event 

15 including information that enables displaying a current status of the screen on a 
terminal without requiring that the preceding outbound and inbound events be 
displayed prior thereto. 

49. (new) The method of Claim 48, further comprising: 

processing at least part of said data representative of outbound, inbound 
20 and united audit events and generating data representative of business events. 

50. (new) The method of Claim 49, further comprising: 

responsive to said data representative of business events generating alerts 
in respect of at least one of said business events. 

51. (new) The method of Claim 50, wherein generating at least some of the 
25 alerts is based on predetermined thresholds. 

52. (new) The method of Claim 48, further comprising: 
storing at least part of the analyzed data. 

53. (new) The method of Claim 48, further comprising: 

storing at least part of the data representative of mirror sessions. 
30 54. (new) The method of Claim 48, further comprising: 
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compressing at least part of said data representative of mirror sessions. 

55. (new) The method of Claim 48, further comprising: 

encrypting at least part of said data representative of mirror sessions. 

56. (new) The method of Claim 48, further comprising: 

5 digitally signing at least part of said data representative of mirror 

sessions. 

57. (new) A program storage device readable by machine, tangibly 
embodying a program of instructions executable by the machine to perform 
method for monitoring and auditing activity of a network, the network utilizes an 

10 incremental protocol, the method comprising: 

analyzing intercepted packets conveyed by entities in the network; 

generating analyzed data based on information associated with at least 
some of said packets, the analyzed data being indicative of sessions; 

responsive to said analyzed data generating in respect of one or more of 
15 said sessions data representative of one or more mirror sessions, each mirror 
session corresponding to a session; and 

processing at least part of said data representative of a mirror session and 

generating data representative of audit events that include inbound audit events 

and outbound audit events, said outbound audit events including information for 

20 instructing a terminal how to draw screens to be displayed thereon and serving to 

prompt a user to perform operations each in respect of a corresponding outbound 

audit event, and said inbound audit events including information representative 

of the operations performed on the terminal in respect of said outbound audit 

events, wherein processing further includes processing successive one or more 

25 outbound audit events and one or more inbound audit events for incrementally 

generating cumulative data representative of a respective united audit event that 

combines preceding outbound and inbound audit events, said united audit event 

including information that enables displaying a current status of the screen on a 

terminal without requiring that the preceding outbound and inbound events be 

30 displayed prior thereto. 
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58, (new) A computer program product comprising a computer useable 
medium having computer readable program code embodied therein for 
monitoring and auditing activity of a network, the network utilizes an 
incremental protocol, the computer program product comprising: 
5 computer readable program code for causing the computer to analyze 

intercepted packets conveyed by entities in the network; 

computer readable program code for causing the computer to generate 
analyzed data based on information associated with at least some of said packets, 
the analyzed data being indicative of sessions; 

10 computer readable program code for causing the computer to generate 

responsive to said analyzed data and in respect of one or more of said sessions, 
data representative of one or more mirror sessions, each mirror session 
corresponding to a session; and 

computer readable program code for causing the computer to process at 

15 least part of said data representative of a mirror session and generate data 
representative of audit events that include inbound audit events and outbound 
audit events, said outbound audit events including information for instructing a 
terminal how to draw screens to be displayed thereon and serving to prompt a 
user to perform operations each in respect of a corresponding outbound audit 

20 event, and said inbound audit events including information representative of the 
operations performed on the terminal in respect of said outbound audit events, 
wherein the computer readable program code is further configured to causing the 
computer to process successive one or more outbound audit events and one or 
more inbound audit events for incrementally generating cumulative data 

25 representative of a respective united audit event that combines preceding 
outbound and inbound audit events, said united audit event including information 
that enables displaying a current status of the screen on a terminal without 
requiring that the preceding outbound and inbound events be displayed prior 
thereto. 

30 
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